DeviceFilter

DeviceFilter 2.0

DevFilter is an application that allows you to monitor all I/O...

DevFilter is an application that allows you to monitor all I/O request packets (IRP`s) on your system, fast I/O requests and capture request input and output data.

It shows you all kernel-mode drivers installed on your Windows NT/2000/XP system and device objects created by these drivers. It also allows you to hook any of these devices (not more then 10 simultaneously, by default) and monitor all requests to selected devices delivered to their dispatch table.

Please, note that it hooks selected device, but not that one which can be on top of this device. This approach allows you to see the IRP path down the device stack, an example to check if it was blocked by upper level filter.